Rogue MFA Provider Can Steal Passwords During Legitimate Logins

A rogue MFA provider can steal passwords while users complete an otherwise legitimate Microsoft Entra sign-in, according to Varonis Threat Labs. The researchers demonstrated the technique, called TrustSink, in a test environment.

The attack requires a hacker to already control a highly privileged Entra account. It does not provide an initial way into an organization.

External Provider Joins the Normal Sign-In Flow

Microsoft Entra lets organizations use external authentication providers for multifactor authentication. After a user enters a password, Entra can redirect the browser to a configured provider for the second step.

The provider then sends Entra a signed token indicating whether the user completed that step. If Entra accepts the token, the sign-in continues.

Varonis found that an attacker with sufficient administrative access could register a malicious External Authentication Method. The attacker could then place that provider in the authentication path for targeted users.

Fake Password Prompt Captures Credentials

In the researchers’ demonstration, users first entered their credentials on Microsoft’s legitimate sign-in page. When Entra requested MFA, it redirected them to the attacker-controlled provider.

Instead of asking for a second factor, the provider displayed a convincing copy of Microsoft’s password prompt. A user who entered their password again sent it to the attacker’s server.

The rogue MFA provider then returned a signed token claiming the MFA step had succeeded. Consequently, Entra completed the login, and the user reached the application they intended to open.

Varonis said sign-ins in its test environment appeared normal while its server collected passwords. The extra prompt could seem plausible because users encounter it at a point when they expect another authentication step.

Password Resets Alone Do Not Remove the Threat

Registering the malicious method requires access to a Global Administrator or Authentication Policy Administrator account. The attacker must also make changes involving an application, service principal and authentication policy.

Once configured, the provider can remain in place across later sign-ins. Varonis found that resetting a captured password did not remove it. The malicious page could capture the replacement password when the user next logged in.

Therefore, administrators investigating this scenario should remove the unauthorized provider and its associated configuration before rotating affected credentials. Varonis also recommends monitoring authentication policy changes and limiting persistent access to highly privileged administrator roles.

The findings describe a post-compromise technique. Varonis demonstrated what an attacker could do after gaining administrative control; the report does not establish that TrustSink has appeared in attacks against organizations.